Flask Request Middleware with CORS, Logging, and API Key Authentication

Flask middleware allows you to execute code before and after every request, making it perfect for cross-cutting concerns like authentication, logging, and CORS headers. Flask provides two key decorators for this: @app.before_request and @app.after_request.

How Flask Request Hooks Work

The @app.before_request decorator registers a function that runs before any route handler is called. This is ideal for:

• Authentication and authorization checks
• Request validation
• Setting up request-scoped data
• Starting timers for performance monitoring

The @app.after_request decorator registers a function that runs after the route handler completes, receiving the response object as a parameter. This is perfect for:

• Adding response headers (like CORS)
• Logging request completion
• Modifying response data
• Cleanup tasks

Using Flask's g Object

Flask provides the g object (application context global) to store data that needs to be shared between before_request and after_request handlers within the same request. Unlike session data, g is request-scoped and automatically cleaned up after each request.

Error Handling in Middleware

If a before_request function returns a response (like jsonify() with a status code), Flask skips the route handler and jumps directly to the after_request handlers. This makes it perfect for authentication middleware that can reject requests early.

Middleware runs in the order it's defined, so organize your handlers logically. Authentication should typically run before other processing, while response modification (like adding headers) should happen in after_request handlers.